{"id":35382,"date":"2026-08-20T15:58:43","date_gmt":"2026-08-20T15:58:43","guid":{"rendered":"https:\/\/certn.co\/security\/"},"modified":"2026-08-20T18:05:29","modified_gmt":"2026-08-20T18:05:29","slug":"security","status":"publish","type":"page","link":"https:\/\/certn.co\/us\/security\/","title":{"rendered":"Security"},"content":{"rendered":"
\n
\n
\n \n\n

2025 Audit Reports Now Available<\/p>\n\n\n\n

Security and trust at Certn.<\/h1>\n\n\n\n

Our Human Risk Intelligence Platform validates identity and migrates risk while
prioritizing the ultimate security, confidentiality, and availability of your data.<\/p>\n\n\n\n

\n
Visit Trust Center<\/a><\/div>\n\n\n\n
View SOC 3 Report<\/a><\/div>\n<\/div>\n\n <\/div>\n <\/div>\n<\/section>\n\n
\n
\n
\n
\n \n
\n
\n \n\n

0<\/h3>\n\n\n\n

BREACHES (SOC 2 PERIOD)<\/p>\n\n <\/div>\n<\/div>\n\n

\n
\n \n\n

24\/7<\/h3>\n\n\n\n

AUTOMATED MONITORING<\/p>\n\n <\/div>\n<\/div>\n\n

\n
\n \n\n

AES-256<\/h3>\n\n\n\n

ENCRYPTION AT REST<\/p>\n\n <\/div>\n<\/div>\n\n

\n
\n \n\n

CLOUD<\/h3>\n\n\n\n

HIGH-AVAILABLITY HOSTING<\/p>\n\n <\/div>\n<\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/section>\n\n\n

\n
\n
\n \n\n

Certifications and reports<\/h2>\n\n\n\n

Certn undergoes rigorous, independent third-party assessments annually to validate the design and operating effectiveness of our security controls. These reports are refreshed on a regular cadence so you’re never looking at stale evidence.<\/p>\n\n <\/div>\n <\/div>\n<\/section>\n\n

\n
\n
\n
\n \n
\n
\n \n\n
\"\"<\/figure>\n\n\n\n

Current and Valid<\/p>\n\n\n\n

SOC 2 Type 2<\/h3>\n\n\n\n

Period:<\/strong> Sept 2024 – Sep 2025<\/p>\n\n\n\n

Evaluates the effectiveness of Certn’s controls regarding Security, Confidentiality, and Availability based on AICPA Trust Services Criteria.<\/p>\n\n <\/div>\n<\/div>\n\n

\n
\n \n\n
\"\"<\/figure>\n\n\n\n

Publicly Available<\/p>\n\n\n\n

SOC 3<\/h3>\n\n\n\n

Period:<\/strong> Sept 2024 – Sep 2025<\/p>\n\n\n\n

A generalized, publicly distributable report detailing the system controls relevant to Security, Confidentiality, and Availability.<\/p>\n\n <\/div>\n<\/div>\n\n

\n
\n \n\n
\"\"<\/figure>\n\n\n\n

Surveillance Cleared<\/p>\n\n\n\n

ISO\/IEC 27001:2022<\/h3>\n\n\n\n

Date:<\/strong> Oct 31, 2025<\/p>\n\n\n\n

Validates that Certn’s Information Security Management System (ISMS) meets the rigorous international standards for data protection and risk management.<\/p>\n\n <\/div>\n<\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/section>\n\n\n

\n
\n
\n \n\n

Security practices<\/h2>\n\n\n\n

Beyond audits and certifications, our day-to-day practices are built to keep your data secure at every layer. From access controls to incident response, security is engineered into how we operate, not bolted on after the fact.<\/p>\n\n <\/div>\n <\/div>\n<\/section>\n\n

\n
\n
\n
\n \n
\n
\n \n\n
\"\"<\/figure>\n\n\n\n

Access Management<\/h3>\n\n\n\n

Centralized identity management via an Enterprise Identity Provider (IdP). We enforce Multi-Factor Authentication (MFA), strict Password Policies, and Role-Based Access Control (RBAC) across all systems. Access reviews occur quarterly.<\/p>\n\n <\/div>\n<\/div>\n\n

\n
\n \n\n
\"\"<\/figure>\n\n\n\n

Data Encryption<\/h3>\n\n\n\n

Data at rest is secured with AES-256 encryption. All web requests and data in transit traverse over encrypted connections using TLS 1.2+ and recognized third-party certificates.<\/p>\n\n <\/div>\n<\/div>\n\n

\n
\n \n\n
\"\"<\/figure>\n\n\n\n

Secure SDLC<\/h3>\n\n\n\n

Software changes are tracked via an enterprise project management tool, require peer reviews, and are tested in non-production environments (free of customer data). We utilize industry-leading Static and Dynamic Application Security Testing (SAST\/DAST) tools.<\/p>\n\n <\/div>\n<\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/section>\n\n\n

\n
\n
\n
\n \n
\n
\n \n\n
\"\"<\/figure>\n\n\n\n

Vulnerability Management<\/h3>\n\n\n\n

Continuous protection including weekly infrastructure vulnerability scans and annual manual penetration tests. Security events are triaged via a formal Incident Response framework.<\/p>\n\n <\/div>\n<\/div>\n\n

\n
\n \n\n
\"\"<\/figure>\n\n\n\n

Resilience and Backups<\/h3>\n\n\n\n

Hosted in secure cloud infrastructure across multiple availability zones. Daily automated backups and an annually tested Business Continuity and Disaster Recovery (BCDR) plan ensure high system availability.<\/p>\n\n <\/div>\n<\/div>\n\n

\n
\n \n\n
\"\"<\/figure>\n\n\n\n

Personnel Security<\/h3>\n\n\n\n

All personnel undergo comprehensive background checks prior to employment. Staff must acknowledge our Code of Conduct and complete security awareness training within 7 days of hire.<\/p>\n\n <\/div>\n<\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/section>\n\n\n

\n
\n
\n \n\n

Security Portal<\/h2>\n\n\n\n

Access our public security programs, policies, and acknowledgments.<\/p>\n\n <\/div>\n <\/div>\n<\/section>\n\n

\n
\n
\n
\n \n
\n
\n \n\n
\"\"<\/figure>\n\n\n\n

Trust Center<\/h3>\n\n\n\n

View our real-time security posture and continuous compliance monitoring.<\/p>\n\n\n\n

Visit the Trust Center<\/a> \"\"<\/p>\n\n <\/div>\n<\/div>\n\n

\n
\n \n\n
\"\"<\/figure>\n\n\n\n

Vulnerability Disclosure<\/h3>\n\n\n\n

Review our guidelines and scope for reporting security vulnerabilities.<\/p>\n\n\n\n

View disclosure guidelines<\/a> \"\"<\/p>\n\n <\/div>\n<\/div>\n\n

\n
\n \n\n
\"\"<\/figure>\n\n\n\n

security.txt<\/h3>\n\n\n\n

Our machine-readable RFC 9116 standards security contact information.<\/p>\n\n\n\n

View security.txt<\/a> \"\"<\/p>\n\n <\/div>\n<\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/section>\n\n\n

\n
\n
\n \n\n

Frequently Ask Questions<\/h2>\n\n\n\n

Common questions from security, risk, and procurement teams.<\/p>\n\n <\/div>\n <\/div>\n<\/section>\n\n

\n
\n
\n
\n
\n <\/div>\n <\/div>\n
\n
\n
\n Where is Certn's data hosted?<\/span>\n \n \n <\/svg>\n <\/div>\n
\n
\n

The Certn Human Risk Intelligence Platform is hosted entirely within secure, ISO 27001-certified enterprise-grade cloud data centers (located in Canada, Australia, the UK, and\/or the EU depending on the region). We do not operate on-premise servers.<\/p>\n <\/div>\n <\/div>\n <\/div>\n

\n
\n Do you perform regular penetration testing?<\/span>\n \n \n <\/svg>\n <\/div>\n
\n
\n

Yes. We conduct external penetration tests at least annually by a certified third-party firm, and internal penetration testing quarterly by our in-house security team. We also maintain a formal Vulnerability Disclosure Program (VDP) to provide safe harbor for responsible security research.<\/p>\n <\/div>\n <\/div>\n <\/div>\n

\n
\n How do you handle customer data deletion requests?<\/span>\n \n \n <\/svg>\n <\/div>\n
\n
\n

We maintain a formal data retention and disposal policy in compliance with applicable regulations (e.g. PIPEDA, GDPR, FCRA). Our platform allows clients to configure their own data retention periods. Secure deletion processes are applied when data is no longer required.<\/p>\n <\/div>\n <\/div>\n <\/div>\n

\n
\n What is you incident response protocol?<\/span>\n \n \n <\/svg>\n <\/div>\n
\n
\n

Certn maintains a formal Incident Management policy. Our SLA is to inform affected clients within 24 hours of becoming aware of a data incident. We utilise an Enterprise SIEM to achieve real-time logging, monitoring, and alerting of security events across our environment.<\/p>\n <\/div>\n <\/div>\n <\/div>\n

\n
\n Have you experienced any recent security breaches?<\/span>\n \n \n <\/svg>\n <\/div>\n
\n
\n

As verified in our latest SOC 2 Type 2 report (covering Sept 16, 2024 to Sept 15, 2025), there were no system incidents requiring disclosure resulting from a control failure or causing significant impairment to our service commitments.<\/p>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/section>\n